FERPA

Background & Basics

• Federal legislation passed in 1974 and since amended
• AKA the Buckley Amendment; the Solomon Amendment is also related
• Designed to protect students’ privacy and access to their education records
• Defines “directory” (public) and non-directory information and disclosure protections
• Framework of student rights and institutional responsibilities

Under FERPA, Students May

• Inspect and review their education records
• Request an amendment of their records to ensure they are not inaccurate, misleading or otherwise in violation of privacy or other rights
• Consent to release or request to restrict disclosure of personally identifiable information contained in their education records, except under certain limited circumstances when, by law, consent is not required
• File a complaint with the US Department of Education concerning alleged failures by Washington University to comply with FERPA requirements

Under FERPA, Institutions Must

• Define “directory” information within limits established by legislation
• Provide students the opportunity and mechanism to opt out of/restrict release of directory information (i.e. “FERPA block” or “FERPA invoke”)
• Only release non-directory information with a signed and dated consent form from the student, or within legal requirements to do so (e.g. accreditation, subpoena), or to a “school official” with a “legitimate educational interest” in the information
• Notify students of institutional FERPA policy annually

FERPA is not

• A data security or retention regulation – no provisions exist for how or how long data is stored
• A mechanism to appeal grades or amend/alter unfavorable records
• An excuse not to engage with third parties or other officials on campus
• The only law or policy that governs access to and release of student data (e.g. HIPAA, GDPR)
• Exclusively a post-secondary education regulation

• To any person who has registered for classes at an “educational institution” that “receives funds under any program administered by the Secretary [of Education]”
• At post-secondary institutions rights transition from parents to student upon collegiate registration regardless of age
• From registration until the student’s death

• To any “education records” – information recorded in any way, including but not limited to handwriting, print or any media
• To records that contain “personally identifiable information” about the student: name, address, ID numbers, or a “list of personal characteristics”
• To records you might not think are education records

Education records include:

• Transcripts
• Grade reports
• Exams
• Assignments
• Disciplinary records
• Photographs
• Learning Management System use
• Advising records and notes
• Email messages to and from or about students
• Enrollment (registration) records
• NCAA records
• ID Card swipe activity
• Pretty much everything a University records and maintains, anywhere!

FERPA doesn’t apply to:

• Things not recorded
• “Sole possession” records – my personal notes stored where only I have access (i.e. a desk drawer)
• Admission/application records, unless they are retained after matriculation
• Law enforcement records if they remain only in law enforcement control
• Employment records, unless student status is a job requirement (as in Federal Work Study)
• Medical records (notes or treatment records from Habif)
• Alumni records

School Officials with a Legitimate Educational Interest

School officials (faculty and staff) with a legitimate educational interest may have access to educational records without the written consent of the student.

• School Officials are employed by WashU in an administrative, supervisory, academic, research or support staff position
• A person acting on WashU’s behalf or as its agent (attorney, auditor, collection agent, or software vendor)
• Legitimate educational interest in that they perform a job or contracted task for which they must use the record/data; acts in the student’s educational interest, with directly identifiable educational relationship with the student(s) involved, for an educationally related purpose
• For staff with system access – this last definition is particularly relevant; data mishandling most often occurs when data is accessed for curiosity or out of a personal relationship or interest in specific education records

Other Parties

In some cases, other parties may also have access to educational records.

• Education officials for audit and evaluation purposes; accrediting organizations
• Organizations conducting studies or services for or on behalf of an institution (attorney, collection agent, software vendor)
• To comply with a judicial order or lawfully issued subpoena
• In case of health or safety emergencies
• Parents of a “dependent” student as verified by IRS documentation

Directory Information

While most information about a student is considered private and no one other than school officials (faculty and staff) with a legitimate educational interest may have access to it without the written consent of the student, certain categories of information designated as “directory information” may be disclosed by Washington University without obtaining the prior consent of the student. At WashU directory information includes:

• Full name
• Home & local address
• Telephone numbers
• Email address
• Photo/video image
• Academic division & field of study
• Dates of attendance
• Previous schools attended
• Graduation dates and degrees earned at WashU
• Class year
• Academic awards/honors
• Participation in intercollegiate athletics
• Height and weight (NCAA Division III athletes only)